From owner-svn-src-head@FreeBSD.ORG  Wed Oct  2 20:44:37 2013
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id 6BDCAAA9;
 Wed,  2 Oct 2013 20:44:37 +0000 (UTC)
 (envelope-from glebius@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 5867C2797;
 Wed,  2 Oct 2013 20:44:37 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r92Kib6Y025940;
 Wed, 2 Oct 2013 20:44:37 GMT (envelope-from glebius@svn.freebsd.org)
Received: (from glebius@localhost)
 by svn.freebsd.org (8.14.7/8.14.5/Submit) id r92KibTC025937;
 Wed, 2 Oct 2013 20:44:37 GMT (envelope-from glebius@svn.freebsd.org)
Message-Id: <201310022044.r92KibTC025937@svn.freebsd.org>
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Wed, 2 Oct 2013 20:44:37 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r256008 - head/sys/net
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Oct 2013 20:44:37 -0000

Author: glebius
Date: Wed Oct  2 20:44:36 2013
New Revision: 256008
URL: http://svnweb.freebsd.org/changeset/base/256008

Log:
  Clear knlist before destroying it in tap(4) and tun(4). This fixes later
  crash, when a kqueue descriptor tries to dereference appropriate knotes.
  
  Approved by:	re (kib)

Modified:
  head/sys/net/if_tap.c
  head/sys/net/if_tun.c

Modified: head/sys/net/if_tap.c
==============================================================================
--- head/sys/net/if_tap.c	Wed Oct  2 20:40:21 2013	(r256007)
+++ head/sys/net/if_tap.c	Wed Oct  2 20:44:36 2013	(r256008)
@@ -220,6 +220,7 @@ tap_destroy(struct tap_softc *tp)
 	CURVNET_SET(ifp->if_vnet);
 	destroy_dev(tp->tap_dev);
 	seldrain(&tp->tap_rsel);
+	knlist_clear(&tp->tap_rsel.si_note, 0);
 	knlist_destroy(&tp->tap_rsel.si_note);
 	ether_ifdetach(ifp);
 	if_free(ifp);

Modified: head/sys/net/if_tun.c
==============================================================================
--- head/sys/net/if_tun.c	Wed Oct  2 20:40:21 2013	(r256007)
+++ head/sys/net/if_tun.c	Wed Oct  2 20:44:36 2013	(r256008)
@@ -258,6 +258,7 @@ tun_destroy(struct tun_softc *tp)
 	if_free(TUN2IFP(tp));
 	destroy_dev(dev);
 	seldrain(&tp->tun_rsel);
+	knlist_clear(&tp->tun_rsel.si_note, 0);
 	knlist_destroy(&tp->tun_rsel.si_note);
 	mtx_destroy(&tp->tun_mtx);
 	cv_destroy(&tp->tun_cv);